5.  The applicant was born in 1975 and lives in the Cēsis District (Latvia).
6.  On 16 June 1997 the applicant gave birth in the Cēsis District Central Hospital (a municipal enterprise, hereinafter “the Cēsis hospital”). Caesarean section was used, with the applicant’s consent, because uterine rupture had occurred during labour.
7.  In the course of that surgery the surgeon performed tubal ligation (surgical contraception) without the applicant’s consent.
8.  On 4 February 2005, after her attempt to achieve an out-of-court settlement with the hospital had failed, the applicant initiated civil proceedings against the hospital, seeking to recover damages for the unauthorised tubal ligation. In December of 2006 her claim was upheld and she was awarded compensation in the amount of 10,000 Latvian lati for the unlawful sterilisation.
9.  On 19 February 2004 the director of the Cēsis hospital wrote to the Inspectorate of Quality Control for Medical Care and Fitness for Work (hereinafter “the MADEKKI”), requesting it to “evaluate the treatment received by [the applicant] during childbirth in accordance with the legislation in force in 1997”. The MADEKKI initiated an administrative procedure on the following day. The administrative inquiry concerned the applicant’s health care and in particular the gynaecological and childbirth assistance she had been provided from 1996 to 2003. In the process of that inquiry the MADEKKI requested and received medical files from three different medical institutions, containing detailed information about the applicant’s health over that period.
10.  In April 2004 M.Z., a MADEKKI staff member, telephoned the applicant and informed her of the on-going inquiry. M.Z. invited the applicant to comment on the case, which she declined to do, referring the MADEKKI to her legal representative, Ms Olsena, instead. During the conversation M.Z. allegedly admonished the applicant for wanting to sue the hospital for damages, and told her that she herself was to blame for her sterilisation.
11.  On 7 May 2004 Ms Olsena asked the MADEKKI for information on the legal grounds for, and the factual circumstances of, the inquiry.
12.  On 14 May 2004 the MADEKKI issued a report concerning the medical treatment given to the applicant during childbirth in 1997. The report contained medical details about the applicant of a particularly private and sensitive character. It concluded that no laws had been violated during the applicant’s antenatal care or during childbirth. A summary of the findings of the report was sent to the director of the Cēsis hospital on 21 May 2004.
13.  On 18 May 2004 the MADEKKI answered Ms Olsena’s questions concerning the administrative inquiry, setting out its opinion on the legal basis for it and providing information on the steps that had been taken in the course of the inquiry.
14.  The applicant’s representative lodged a claim with the Administrative District Court, alleging that the MADEKKI had initiated the inquiry unlawfully, since in essence its purpose had been to help the Cēsis hospital to gather evidence for the impending litigation, which was outside the MADEKKI’s remit. It was also alleged that the MADEKKI had acted unlawfully in requesting and receiving information about the applicant’s health, as it had violated the applicant’s right to respect for her private life. That right had been further violated when the MADEKKI unlawfully transferred the applicant’s data to the Cēsis hospital. Lastly, the court was requested to annul an administrative act – the MADEKKI’s report – since its findings were erroneous. Compensation in the amount of 500 Latvian lati was requested in respect of non-pecuniary damage.
15.  On 12 May 2005 the Administrative District Court adopted a judgment by which it terminated the proceedings with regard to the request to annul the MADEKKI report, as in the court’s opinion the report did not create any specific rights or obligations for the applicant and thus could not be considered an administrative act, and dismissed the remainder of the application as ill-founded.
16.  Counsel for the applicant appealed and on 16 June 2006 the Administrative Regional Court adopted a judgment by which it upheld in full the first-instance court’s judgment and endorsed that court’s reasoning, essentially equating the activities of the MADEKKI with the provision of health care, which, according to domestic law, was a legitimate reason for gathering personal data.
17.  On 8 February 2007 the Senate of the Supreme Court dismissed an appeal on points of law lodged by the applicant, in which reference was made, inter alia, to Article 8 of the Convention and to the cases of Z v. Finland (25 February 1997, Reports of Judgments and Decisions 1997‑I) and M.S. v. Sweden (27 August 1997, Reports of Judgments and Decisions 1997‑IV).
18.  The Senate agreed with the lower courts that the MADEKKI report could not be considered an administrative act. It further considered that this report was not an action of a public authority (faktiskā rīcība) and thus was not amenable to review in administrative courts.
19.  It thus remained for the Senate to address the applicant’s claims that the MADEKKI’s actions in preparing the report had been unlawful. In this regard the Senate considered that the Medical Treatment Law gave the MADEKKI the right to examine the quality of medical care provided in medical institutions not only upon receiving a corresponding complaint from a patient but also when a request for such examination had been submitted by a medical institution, which had an obligation to protect the interests of the society so that, should any irregularities be found by the MADEKKI, they might be eliminated and their recurrence with respect to other patients avoided in the future.
20.  The Senate agreed with the applicant that the processing of sensitive data concerning her constituted an interference with her rights guaranteed by, inter alia, Article 8 of the Convention. The Senate then went on to summarise the findings of the Strasbourg Court in the two cases invoked by the applicant, emphasising in particular that the Convention left to the States a wide margin of appreciation in balancing the confidentiality of medical data and the necessity to preserve patients’ confidence in the medical profession and in the health services in general.
21.  The Senate further held that both the Medical Treatment Law and the Personal Data Protection Law contained exceptions that permitted the MADEKKI to collect and process the otherwise confidential medical data. The former listed such exceptions explicitly (see paragraph 30 below), while the latter allowed processing of medical data for the purposes of medical treatment or the provision or administration of heath care services (see paragraph 28 below) or if processing of personal data was necessary for a system administrator to carry out his legal duties (see paragraph 29 below). The Senate continued as follows: “according to [the law] the MADEKKI has a duty to control the quality of medical care. In order to carry out such control, the MADEKKI requires information about the patient and his care”.
22.  The Senate concluded as follows:
“Taking into account the aforementioned, the [Senate] finds that restrictions to a person’s private life connected to gathering and processing of sensitive personal data are provided for by law. When regulating this question, the legislator has already assessed the aim and proportionality of such restrictions, as well as has provided for safeguards against unjustified disclosure of the above-mentioned data. Consequently [the applicant’s] argument that the Regional Court ought to have assessed the aim and proportionality of the restriction is unfounded.
Additionally the [Senate] considers that the Regional Court has correctly interpreted and applied the above-mentioned legal provisions and has come to the correct conclusion that the MADEKKI, in order to carry out the control of the quality of medical care, which it is competent to do, had a right to receive and process [the applicant’s] sensitive data without asking for her consent and that the MADEKKI has acted within its sphere of competence and in accordance with the provisions of the law concerning the processing of sensitive personal data. The MADEKKI used the information it had collected about [the applicant] in order to carry out its functions, namely, to control the quality of the medical care provided to [the applicant], while to the Cēsis hospital it only handed over its conclusions concerning the legality of the doctors’ actions, which did not contain [the applicant’s] sensitive data.”
23.  For these reasons the Senate decided to uphold the lower courts’ decisions.
24.  Section 10 of the Medical Treatment Law (Ārstniecības likums) at the relevant time provided that the MADEKKI was the institution responsible for monitoring the quality of medical care provided in medical institutions.
25.  The MADEKKI’s work at the relevant time was governed in more detail by its statute (nolikums), which had been approved by the Cabinet of Ministers. The statute provided that the MADEKKI was a government institution, whose main functions were to inspect and monitor the professional quality of health care in medical institutions irrespective of their ownership status (paragraph 1). Paragraph 3 of the statute listed the principal functions of the MADEKKI, such as to examine complaints in order to protect the rights of patients (paragraph 3.3), to oversee and issue reports concerning the professional quality of medical care in the event of complaints (paragraph 3.4), to issue reports on the quality of medical care in medical institutions (paragraph 3.6) and the like.
26.  According to its statute the MADEKKI had a right to carry out scheduled (“plānveida”) checks on the quality of medical care as well as to carry out the required checks in response to complaints and requests (paragraph 4.1). Paragraph 4.2 authorised the MADEKKI “to request from private individuals and officials documents and information concerning questions within its field of competence”. If the MADEKKI found that laws had been broken in the course of providing health care, it was authorised to apply administrative fines and issue warnings, as well as to give appropriate recommendations to doctors and administrators of medical institutions.
27.  Lastly, section 72 of the MADEKKI statute provided that its staff had to maintain confidentiality with regard to any information obtained in the performance of their professional duties.
28.  The Personal Data Protection Law (Fizisko personu datu aizsardzības likums) provides, in section 11, that the processing (which is defined as any activities with personal data, including collecting, registering, using, and so on) of sensitive personal data (including information about a person’s health) is permitted only after having received written consent from the data subject. Without such consent personal data may be processed only in a limited number of situations, including “if ... necessary for the purposes of medical treatment [or] the provision or administration of heath care services” (section 11(5)).
29.  Section 7 of the Personal Data Protection Law provided more generally that processing of personal data was allowed only if that law did not provide otherwise and if at least one of the other conditions was present. One of the additional conditions was that the processing of the data was necessary for a system administrator to carry out his legal duties (section 7(3)). A “system administrator” for the purposes of this Law was “a natural or legal person who determines the aims of a data processing system and the means of processing [of the data]”.
30.  As in force at the relevant time, section 50 of the Medical Treatment Law provided that information concerning patients’ treatment and diagnosis could only be provided to a limited number of institutions, including the MADEKKI.